Slashdot Mirror
500 Million Users At Risk of Compromise Via Unpatched WinRAR Bug
An anonymous reader writes: A critical vulnerability has been found in the latest version of WinRAR, the popular file archiver and compressor utility for Windows, and can be exploited by remote attackers to compromise a machine on which the software is installed. "The issue is located in the 'Text and Icon' function of the 'Text to display in SFX window' module," Vulnerability Lab explained in a post on on the Full Disclosure mailing list. "Remote attackers are able to generate own compressed archives with malicious payloads to execute system specific codes for compromise."
I must admit some of these security exploits elude me a little, but I've read both of TFAs, and I guess my question is "what the heck is this SFX window and what's it for"?
Why the heck is an archiving program executing arbitrary code in the first place? That's crazy.
Lost at C:>. Found at C.
If you download and willingly execute an .exe you're already fucked.
So a self-extracting RAR can be rigged to exploit your machine. A self-extracting RAR is an executable. So a executable from an untrusted source can exploit your box. Wake me when you have a real vulnerability.
Oh, and samzenpus, that was the most clickbait bullshit Slashdot headline in months. You should be horsewhipped.
On the contrary; WinRAR sucks because it isn't open source. Instead, it's proprietary, spammy nag-ware.
7Zip, the actual open source competitor to WinRAR, is much better.
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
So... you can use WinRAR to create an executable file that executes code?
I guess I'd better get cl.exe and gcc off my systems, too.
And they're complaining about security flaws in closed-source, for-profit software.
I have both 7zip and winrar installed, and I gotta say I much prefer using winrar over 7zip. The UI is just a lot more elegant and intuitive, and the shell integration works better.
I was surprised to learn that Winrar had that many users, considering it's a paid application. I'm one of those weirdos who did pay for it (they gave me a special for $15) even though I do indeed pirate a lot of stuff.
On the contrary; WinRAR sucks because it isn't open source
That's a bold statement because it goes either way. There are open source products that are better just because they are free and some are better because they simply are better. There are commercial products out there that outweigh open source products just because they have large teams with the right expertise and money to keep it going forward.
7Zip, the actual open source competitor to WinRAR, is much better
7Zip is better in many ways. Lightweight is the one major thing it has on WinRAR.
7Zip would have the same issues if it offered a self extracting option.
I don't even bother with 7z format because modern OSs support ZIP out of the box. I only install 7-zip for slightly better interface than the one built in to the OS, but I know that anyone I send the file to can read the file.
Well... Not to underestimate the finding, but frankly it's nothing new. Executables may carry malicious code, no matter how innocent they look.
To avoid running the executable, you can use WinRAR (or 7Zip etc) to open the SFX as if it were a regular archive.
In terms of features, WinRAR is far better (most notable with customizable fault tolerance / recovery options, PAR files, the SFX module, etc.).
In terms of compression performance, they're neck and neck. This has been true since the RAR5 format was released. A recent update to 7-Zip allowed for the opening of RAR5 archives, if you for some reason really hate WinRAR.
In terms of freeness, 7-Zip is better if you care. 7-Zip is open source and costs nothing, while WinRAR is closed source and costs nothing for personal use (it'll popup a registration screen once in a while but it still runs with all features enabled).
In terms of scripting up custom, complex compression tasks 7-Zip is far better.
I use 7-Zip, but I installed WinRAR when people started using RAR5 archives (before 7-Zip supported opening them). I was pleasantly surprised at how fucking good it was. I still use 7-Zip primarily, but that's just because I have it installed everywhere.
The SFX module is part of the UI. I wouldn't consider arbitrary code execution to be elegant.
7Zip would have the same issues if it offered a self extracting option.
7zip has self-extracting support.
7Zip has the option to build self extraction archives.
How is this a remote exploit? It seems you have to download the malicious file and run it.
I have 7zip installed because it can extract RAR files and it isn't WinRAR.
It is, well, optionally paid application. It nags you to pay if you open the main window, but it is mostly used as a shell extension (well, at least I use it that way). I decided to pay after years of hassle-free use.
if you for some reason really hate WinRAR.
Or if you just don't feel like having a ton of programs installed just for proprietary formats. I haven't run into anything that 7-zip couldn't open, so why would I bother installing anything else?
It's free for personal use and there's people out there that haven't heard of 7-zip.
That's a bold statement because it goes either way. There are open source products that are better just because they are free and some are better because they simply are better. There are commercial products out there that outweigh open source products just because they have large teams with the right expertise and money to keep it going forward.
This is not really one of those cases though, archiving has become a commodity and the only reasons WinRAR has a huge following is that it is old (1995) from before Windows XP came with built-in ZIP support , it became the de facto archive format on Usenet and there's no open specification so competing tools can't create RAR files. It does absolutely nothing special that other tools don't do.
Live today, because you never know what tomorrow brings
> It's free for personal use
[citation needed]
Came here to say this.
If you make .rar files, you're part of the problem.
"When information is power, privacy is freedom" - Jah-Wren Ryel
I've seen issues across several production environments where several .zip tools would miss files in very large archive sets, moving to .7z fixed these issues.
Same here. I get blasted by people regularly for using WinRAR instead of 7-Zip, but I prefer it for the exact same reason you do. It's just more convenient to use. Hell, I even paid for it.
However, to avoid warring about it and for the sake of ease of file exchange, I only create ZIP files. For the same reason, I am thoroughly annoyed by people using the 7-Zip format for archives. The few extra bytes saved is not worth the annoyance, neither for RAR nor 7z files.
7Zip is better in many ways. Lightweight is the one major thing it has on WinRAR.
Some would claim that it isn't even the most major thing. The .7z format is documented, like the .zip format and notably unlike the .rar format, which all about about a dozen people are legally prohibited from understanding because of the UnRAR license.
You would install WinRAR because someone requires you to submit an archive in RAR format and nothing but WinRAR (or command-line products from the same company) can create archives in RAR format. But in practice, I don't expect this to come up very often outside the warez scene, whose release standards have traditionally required split RAR.
I also have both and like WinRAR more.
Open WinRAR
go to Help/About WinRAR...
click on the books
This is why it's better.
What "scene"? Do you mean the warez scene? I thought it was still using RAR files split into several dozen pieces.
7zip isn't intuitive? How dumb do you have to be to type something like that.
Surprisingly less dumb than somebody who responds to a remark that wasn't actually made.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
Thanks to those who corrected me on the self extracting feature. I didn't know it was available.
Agreed, but his statement was broad and assuming open source automatically equals better which we both know is not true. In this case it may be but lets not make it a rule of thumb.
Up until August of 2015, 7-Zip could not open RAR5 archives (which were introduced introduced in August of 2013).
So while YOU may have not run into anything that 7-Zip couldn't open, there were 2 years where 7-Zip couldn't open newer RAR archives.
Using a self extracting winRAR file as a vector to run code on Windows - is a vulnerability is Windows.
'Execution of poc.pl aborted due to compilation errors.'
I am thoroughly annoyed by people using the 7-Zip format for archives. The few extra bytes saved is not worth the annoyance, neither for RAR nor 7z files.
What annoyance?
The Daddy casts sleep on the Baby. The Baby resists!
@slashdime: "The SFX module is part of the UI. I wouldn't consider arbitrary code execution to be elegant."
Yea, it's designed as standard behaviour. There's a post extraction utility that'll run any valid script. But who in their right minds runs somefile.exe on their 'computer'. Oh, wait, no need to answer that one.
See samzenpus, it's not difficult to think up an accurate title :)
New RAR files made with the RAR5 format. I doubt it was a requirement, WinRAR could likely still use RAR4. Also the vast majority of compressed files I've encountered are .zip.
"The UI is just a lot more elegant and intuitive" implies that 7zip's interface is not intuitive as compared to WinRAR."
Yes, that is the statement the OP made. You responded as if he had said:
7zip is unintuitive.
Which is a statement he did not make.
Congratulations on winning the dumbass award.
Mmm Hm.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
You believe in the concept of a "real" name... How quaint. Sure there is such a thing as a legal name that you use on legal forms, and a lot of times people think that is your "real" name. But how real is it? Is it what your friends, family, acquaintances or coworkers call you? Probably not. I just put hackwrench into Bing and my slashdot page is on the first page of listings. My blog is in the first page of results in Google. That real enough for you?
I have both 7zip and winrar installed, and I gotta say I much prefer using winrar over 7zip. The UI is just a lot more elegant and intuitive, and the shell integration works better.
Me too. Winrar's interface is just better for me. It has tons of options for fine-tuning or customizing your work flow. I don't like change and they haven't really changed the interface much in a very long time. If it isn't broke, don't fix it.
The RAR file format itself seems to have more features, probably because the guy makes money off his software and can afford to devote more time to responding to customer suggestions and requests. Winrar is paying the bills, Mr. Roshal and his brother are highly motivated to keep their customers happy. I can easily imagine an open source developer ignoring the feature/bugfix requests of others to work on whatever they feel like.
Even those who arrange and design shrubberies are under considerable economic stress at this period in history.
7z has better compression, is typically faster, multi-platform, and FREE. Why people use winrar over 7z, I can't understand.
And require a crack to get working properly? Why would anyone still use that crap. As everyone else has said, 7-zip has I thought, been standard for like 5 years, which is eternity in internet time... Do the slashdot editors still use winrar or something because they are stuck in the glory days of yore?
That, or they really are out of tune with the windows software scene.
-
Relax man. You don't have to pretend to pirate "lots of stuff" just to fit in here. I almost always buy things that I like and find useful.
It's hard to take you seriously when all one has to do is scroll up.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
But they're not very tasty.
"So long and thanks for all the fish."
As I recall. HTH
7-Zip can be hard to use and install. ZIPmagic is 100% free for file compression, consumes the 7-Zip stack as well as supporting ZIPX for JPEG compression, and integrates with Windows Explorer for 100% transparent archive management (like ZIPfolders, but for 85+ archive types, including RAR and even the new RAR5 format). Things like drag/drop, copy/paste work seamlessly with ZIPmagic's archives-as-folders feature, transparently launching associated software and even updating the source archive when your changes are saved.
Actually, 7-zip offers SFX. BTW: I agree, open source isn't a "magic bullet" for a good software.